MALICIOUS — c2c53d2de6ac0056464a5a080048eb6bcf8b46baf4c42936378a3580cf25ec69

MALICIOUS — c2c53d2de6ac0056464a5a080048eb6bcf8b46baf4c42936378a3580cf25ec69 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Fileinfector family. 5 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: c2c53d2de6ac0056464a5a080048eb6bcf8b46baf4c42936378a3580cf25ec69
SHA-1: bd17baf12d867d0fec51b1c641c1c8af5ef55762
MD5: 0b48b5db6aa02f996df0a4e39aeba5f6
imphash: a9192bab5c7c795c7488b69a1853f9c2
ssdeep: 6144:MZ051ZLZ051ZLZ051Z8ZLZ05aZ051ZLZ05aZ051eP1ZVI51yZAv:MaNaNa2NBaNBz1M51yZAv
TLSH: T1C64B90D472407711EEF0F9589C04AC2CB192D9A662363BD86902D47F74F97F706A882E
Submitted as: c2c53d2de6ac0056464a5a080048eb6bcf8b46baf4c42936378a3580cf25ec69
File type: pe · Size: 489212 bytes
Verdict: malicious (100/100) · Family: Fileinfector

Detections (5 of 56 engines)

ClamAV (daily): Win.Malware.Fileinfector-9834127-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/CryptInject!pz
Trellix Stinger (McAfee): Trojan-FUFL!0B48B5DB6AA0
Kaspersky (KVRT): Virus.Win32.Lamer.ks

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Malware.Fileinfector-9834127-0 (rule Win.Malware.Fileinfector-9834127-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/CryptInject!pz (rule Trojan:Win32/CryptInject!pz) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FUFL!0B48B5DB6AA0 (rule Trojan-FUFL!0B48B5DB6AA0) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Lamer.ks (rule Virus.Win32.Lamer.ks) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Extracted JavaDropper config (0 C2) - engine signal, weight 0.45, confidence 0.60
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://www.pinkworld.com, http://www.youporn.com, http://www.redtube.com - static signal, weight 0.35, confidence 0.60
Dropped 23 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

84682 behavior events · 2 ATT&CK techniques · 38 dropped files.

Dropped files

C:\Windows\System32\vulkan-1.dll - 5bc8c000f8208b65b3f987ab8a4ea38775317479aa1695dbaa88915923d92647
C:\Windows\py.exe - bf9f35241a9eec66d2dff0e309b811362b85f8f630bac4fa812c20b3e1fbff5d
C:\Windows\System32\mfcm140.dll - 8c81c6d40013492fad3b2e3e1ed48f71452b0bdfaedcf912d42da1ac80e34232
C:\Windows\setuperr.log - e9c5813b3bff9f2db96d504ab5bbdfb5c26bd35cb2632eb7f82513b2f6f40d58
C:\Windows\System32\license.rtf - d232b38eee5c89025a548066cdd0b4c0f34b07205f45fd08fff986f3a4d70ad3
C:\Windows\System32\mfc140.dll - 472695be28afd71a7319d1bb7731afb9a42ed34d0c60470b4c4b5396e727117b
C:\Windows\System32\vcruntime140.dll - b956affeb790899062c887d36f775b77ca2f7bd460fac5d936fde6decd213f06
C:\Windows\SysmonDrv.sys - 3e4c595080e5d8e42682c502caca39413d6afdf1d9faf42e4c3108edba345d67
C:\Windows\System32\vcomp140.dll - 02d13d5399a9835fb60b36de5327a2684888036c8a03c9b21d59f35a1d7e8051
C:\Windows\System32\vcruntime140_threads.dll - d034af9b4b598e67a49d4430bc910ae714c57c85c72306a5cf9a97f894c5d4d7
C:\Windows\System32\mmc.exe.config - cc49e70cad1957246f528ad02b39f952046d22dc55fb1ea7bb56c516dd53d319
C:\Windows\System32\msvcp140_1.dll - 7155e523b8d2a8af42b69b079ec0ca8fef9d0071b8f07444e4dfbd11e5b667c9
C:\Windows\System32\NOISE.DAT - 2c297855886440e24a7842b86fd0d8474cd6795dc3c99a68a02f06ff3b7e0b39
C:\Windows\pyw.exe - 04f3a57bac84e4ec7978ffba507e61c1a57ffc1f9a4ee1fd5d86482ab5529e53
C:\Windows\System32\mfc140u.dll - 92f490781ef916d3b871220a9ba67063a0f162c3beb09a3c31ed063e4931b6fa

Embedded URLs

http://www.pinkworld.com
http://www.youporn.com
http://www.redtube.com
http://www.assparade.com/
http://www.freeav.com/
http://www.antispyware.com/
http://www.antivirus.com/
http://crl.thawte.com/ThawteTimestampingCA.crl0
http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
https://www.verisign.com/rpa
http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D
https://www.verisign.com/rpa0
http://csc3-2010-aia.verisign.com/CSC3-2010.cer0
https://www.verisign.com/cps0*
http://logo.verisign.com/vslogo.gif04
http://crl.verisign.com/pca3-g5.crl04
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

www.pinkworld.com
www.youporn.com
www.redtube.com
www.assparade.com
www.freeav.com
www.antispyware.com
www.antivirus.com
crl.thawte.com
ts-aia.ws.symantec.com
ts-crl.ws.symantec.com
www.verisign.com
csc3-2010-crl.verisign.com
csc3-2010-aia.verisign.com
logo.verisign.com
crl.verisign.com
aefd.nelreports.net
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

52.168.117.171
52.253.84.76
52.123.252.195
4.230.171.124
52.182.143.212
40.84.97.4
135.234.160.246
172.215.188.232
52.148.114.188
57.155.101.212
20.42.179.192
172.172.255.218
72.145.35.99
52.110.12.33
52.110.12.4

File paths

C:\BUILD_~1\jdk6_45\control\build\WINDOW~1\tmp\java\javaw\obj\javaw.pdb

More Fileinfector samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report